Please refer to the following deployment prerequisites:

• Upgrade DSM Server version to 12.5 FR-2020-01-27 (12.5.613) or later.
• Import DSVA 12.0 U3 (12.0.682) package to DSM Server.
• Setup HTTP Web server for DSVA deployment.
  Refer to the KB article on Known issues when deploying Deep Security Virtual Appliance in VMware NSX-T 2.5 .
• Allow DSM server communicate with DSVA via IP address.

Follow these steps for deployment:

1. Keep DSM on version 12.0 and remove existing vCenter connector to unregister Partner Service Manager from NSX-T 2.5.0.
   1. Remove the DSVA service deployment plan.
   2. Remove the vCenter connector to force unregister Partner Service Manager from NSX-T 2.5.0 success. Check if the Partner Service has been removed.

      

2. Upgrade the DSM server to 12.5 FR-2020-01-27 (12.5.613) or later.
3. Enable DSVA with Coexist GI+SI function via dsm_c command from DSM server:
   1. Open Command Prompt or PowerShell with local administrator privilege.
   2. Switch working path to DSM default installed folder (ex: C:\Program Files\Trend Micro\Deep Security Manager).
   3. View default value of configuration item: settings.configuration.nsxtAllowNetworkFunctionality

      settings.configuration.nsxtAllowNetworkFunctionality
      >
      .\dsm_c -action changesetting -name settings.configuration.nsxtAllowNetworkFunctionality -value true
      Return the value: false

   4. Change above configuration item with value ‘true’.

      >.\dsm_c -action changesetting -name settings.configuration.nsxtAllowNetworkFunctionality -value true

      

4. Add vCenter connector and NSX-T server from DSM web console. The DSM will register the GI+SI function to NSX-T. Sign on NSX-T web console > System > Service Deployment > CATALOG and it will show both “Endpoint Protection Policy” and “Next Generation Firewall” on Functionality.

   

5. Copy the target DSVA packages (ex: dsva-12.0.0-682-small.ovf, dsva-12.0.0-682-small.mf and dsva-12.0.0-682-small.cert) from DSM\temp\Appliance-ESX-12.0.0-682.x86_64 to HTTP server.
   Please note the DSVA packages for GI without build info. To deploy coexisting GI+SI DSVA, select packages with build info.

   

   

6. Modify the DSVA download URL from vCenter connector > NSX configuration.
   For example: http://10.209.66.8:8080/small/dsva-12.0.0-682-small.ovf

   

   Check if the URL is updated to NSX-T correctly. Click Deploy Service and check the icon from Deployment Specification. Dump the OVF URL for future deployment.

   

7. Create Service Deployment plan from NSX-T to deploy DSVA.
   Follow the general Service Deployment procedure same as GI in the Deep Security Help Center.
   There are two required procedures during the deployment:
   1. Select both ens0 and ens2 during the network configuration. The Network could be ESXI standard switch, Distribution Switch (VDS) and Logical Switch (nVDS).

      

   2. Creating a Service Segment is required. This will bind the Transport Zone used for SI function for coexisting GI+SI DSVA. Please note that the Service Segment is only allowed to be created from standard transport zone. The enhanced Transport zone is not supported.

      

8. DSVA connect to nVDS Logical switch and activate success. From vCenter view:

   

   From NSX-T view: